Re: kern/39307 (mfs will sometimes panic at umount time)

[Izumi Tsutsui <tsutsui%ceres.dti.ne.jp@localhost>]

The following reply was made to PR kern/39307; it has been noted by GNATS.

From: Izumi Tsutsui <tsutsui%ceres.dti.ne.jp@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: kern-bug-people%NetBSD.org@localhost, netbsd-bugs%NetBSD.org@localhost, 
gnats-admin%NetBSD.org@localhost,
        ad%NetBSD.org@localhost, cube%cubidou.net@localhost, 
tsutsui%ceres.dti.ne.jp@localhost
Subject: Re: kern/39307 (mfs will sometimes panic at umount time)
Date: Thu, 25 Sep 2008 00:32:43 +0900

 > Synopsis: mfs will sometimes panic at umount time
  :
 > Should be fixed - please verify.
 
 A cobalt kernel (in restorecd, which uses mfs for many dirs)
 still fails:
 ---
 NetBSD 4.99.72 (GENERIC) #1: Wed Sep 24 23:50:46 JST 2008
         
tsutsui@mirage:/home/tsutsui/cobalt/restorecd/usr/src/sys/arch/cobalt/compile/obj.cobalt/GENERIC
 Cobalt Qube 2
 total memory = 65536 KB
 avail memory = 59624 KB
 mainbus0 (root)
 com0 at mainbus0 addr 0x1c800000 level 3: st16650a, working fifo
 com0: console
 cpu0 at mainbus0: QED RM5200 CPU (0x28a0) Rev. 10.0 with built-in FPU Rev. 10.0
 cpu0: 32KB/32B 2-way set-associative L1 Instruction cache, 48 TLB entries
 cpu0: 32KB/32B 2-way set-associative write-back L1 Data cache
 
  :
 
 Sep 24 23:39:27 client reboot: rebooted by root
 Sep 24 23:39:27 client syslogd: Exiting on signal 15
 trap: TLB miss (load or instr. fetch) in kernel mode
 status=0xff03, cause=0x8, epc=0x802f99f8, vaddr=0xc6474034
 pid=125 cmd=mount_mfs usp=0x7fffca00 ksp=0xc6481d10
 Stopped in pid 125.1 (mount_mfs) at     netbsd:atomic_dec_uint_nv+0x18: lw     
 s0,0(s2)
 db> tr
 atomic_dec_uint_nv+18 (c6474034,83c21ab4,0,0) ra 80256184 sz 32
 vfs_destroy+18 (c6474034,83c21ab4,0,0) ra 8025d3ec sz 24
 do_sys_mount+814 (83c57800,83c21ab4,0,7fffef94) ra 8025d430 sz 256
 sys___mount50+3c (83c57800,83c21ab4,c6481f68,7fffef94) ra 802a24a0 sz 48
 syscall_plain+130 (83c57800,83c21ab4,c6481f68,7fffef94) ra 8029bffc sz 80
 mips3_SystemCall+bc (83c57800,83c21ab4,c6481f68,7fffef94) ra 7de3d7b0 sz 0
 PC 0x7de3d7b0: not in kernel space
 0+7de3d7b0 (83c57800,83c21ab4,c6481f68,7fffef94) ra 0 sz 0
 User-level: pid 125.1
 db> 
 ---
 Note 'umount -a' before reboot(8) (though it fails to umount mfs
 due to device busy) seems to prevent the panic.
 
 
 i386 GENERIC kernel (which is a cdroot server of cobalt restorecd,
 also uses mfs heavily) also fails:
 ---
 NetBSD 4.99.72 (GENERIC) #0: Wed Sep 24 23:59:51 JST 2008
         
tsutsui@mirage:/home/tsutsui/cobalt/restorecd/usr/src/sys/arch/i386/compile/obj.i386/GENERIC
 total memory = 767 MB
 avail memory = 742 MB
 VIA Technologies, Inc. VT8363 ( )
 mainbus0 (root)
 cpu0 at mainbus0: AMD 686-class, 1300MHz, id 0x671
 acpi0 at mainbus0: Intel ACPICA 20080321
 
  :
 
 bootserver# reboot
 Sep 24 15:18:15 uvm_fault(0xcadb98f0, 0, 1) -> 0xe
 fatal page faultbootserver reboo in supervisor mode
 trap type 6 code 0 eip c047c6e9 cs 8 eflags 10206 cr2 8 ilevel 0
 kernel: supervisor trap page fault, code=0
 Stopped in pid 60.1 (mount_mfs) at      netbsd:bt_rembusy+0x9:  movl    
0x8(%edx),%ecx
 db{0}> tr
 
bt_rembusy(c1ad2800,c1ad2800,cc29dca0,cc1c8000,0,1,cc1ebb8c,c0472fe1,c1ad2800,cc1c8000)
 at netbsd:bt_rembusy+0x9
 
vmem_xfree(c1ad2800,cc1c8000,910,c04ac8b6,c0b0c260,cc1c8000,cc1ebbac,c04b21ca,cc1c8000,910)
 at netbsd:vmem_xfree+0x46
 
kmem_free(cc1c8000,910,cc286b90,1286a20,cc286a20,cc286a20,cc1ebcbc,c04b8fec,cc1c8000,0)
 at netbsd:kmem_free+0x21
 vfs_destroy(cc1c8000,0,0,cc1ebce0,0,0,cc1ebbfc,cc1ebbf8,1da6f00,c1b9f300) at 
netbsd:vfs_destroy+0x7a
 do_sys_mount(cc29dca0,0,8050db7,bfbfff96,5c,bfbfecc0,0,78,cc1ebd28,cc29dca0) 
at netbsd:do_sys_mount+0x9ac
 
sys___mount50(cc29dca0,cc1ebd00,cc1ebd28,8050db7,bfbfff96,5c,bfbfecc0,78,64,8051040)
 at netbsd:sys___mount50+0x49
 syscall(cc1ebd48,b3,ab,bfbf001f,bbbc001f,0,bfbfeec4,bfbfee48,0,bfbfecc0) at 
netbsd:syscall+0xa0
 db{0}> 
 ---
 Izumi Tsutsui